Vulnerability Description
The utf-16 decoder in Python 3.1 through 3.3 does not update the aligned_end variable after calling the unicode_decode_call_errorhandler function, which allows remote attackers to obtain sensitive information (process memory) or cause a denial of service (memory corruption and crash) via unspecified vectors.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Python | Python | >= 2.7.0, < 2.7.4 |
| Canonical | Ubuntu Linux | 10.04 |
| Debian | Debian Linux | 6.0 |
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=670389Third Party Advisory
- http://bugs.python.org/issue14579Vendor Advisory
- http://secunia.com/advisories/51087Third Party Advisory
- http://secunia.com/advisories/51089Third Party Advisory
- http://www.openwall.com/lists/oss-security/2012/04/25/2Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2012/04/25/4Mailing ListThird Party Advisory
- http://www.ubuntu.com/usn/USN-1615-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-1616-1Third Party Advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=670389Third Party Advisory
- http://bugs.python.org/issue14579Vendor Advisory
- http://secunia.com/advisories/51087Third Party Advisory
- http://secunia.com/advisories/51089Third Party Advisory
- http://www.openwall.com/lists/oss-security/2012/04/25/2Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2012/04/25/4Mailing ListThird Party Advisory
- http://www.ubuntu.com/usn/USN-1615-1Third Party Advisory
FAQ
What is CVE-2012-2135?
CVE-2012-2135 is a vulnerability with a CVSS score of 6.4 (MEDIUM). The utf-16 decoder in Python 3.1 through 3.3 does not update the aligned_end variable after calling the unicode_decode_call_errorhandler function, which allows remote attackers to obtain sensitive inf...
How severe is CVE-2012-2135?
CVE-2012-2135 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-2135?
Check the references section above for vendor advisories and patch information. Affected products include: Python Python, Canonical Ubuntu Linux, Debian Debian Linux.